Patient Privacy Notice
Last updated: 15.09.2026
We are committed to protecting your privacy and handling your personal and health information securely, lawfully and confidentially.
This Privacy Notice explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, how long we retain it and your rights in relation to your information.
This notice applies to patients who use our physiotherapy consultation services, including video consultations with Claire Robertson, Specialist Physiotherapist Consultant.
1. Who is responsible for your information?
The organisation or individual responsible for deciding how and why your personal information is processed is the data controller.
Data Controller: Improval 3
Trading name: Claire Patella
Email: info@clairepatella.com
If you have any questions about how your information is handled, please contact us using the details above.
2. What information do we collect?
Depending on the service you receive, we may collect and process:
Identification and contact information
- full name.
- date of birth.
- home address.
- email address.
- telephone number.
- emergency/next-of-kin contact details; and
- information needed to communicate with you about your appointment.
Healthcare information
We may collect information necessary to assess and provide physiotherapy care, including:
- your symptoms and medical history.
- previous diagnoses.
- current and previous treatment.
- relevant medication information.
- physiotherapy information.
- GP or healthcare professional details.
- scan and imaging reports.
- medical letters.
- investigation results.
- treatment and rehabilitation information.
- clinical observations.
- clinical assessment findings; and
- other information relevant to your care.
Where clinically necessary and with appropriate consent, photographs, video or other recordings may form part of your clinical record.
We will not make photographs, video or audio recordings for clinical or other purposes unless there is an appropriate lawful basis and, where required, your consent.
3. Why do we use your information?
We use your information to:
- arrange and administer your appointments.
- provide physiotherapy assessment and care.
- understand your medical history and current condition.
- provide safe and appropriate clinical advice.
- maintain accurate clinical records.
- communicate with you about your care.
- provide clinical letters, reports or exercise programmes where appropriate.
- arrange or recommend further assessment, investigation or referral.
- respond to your questions and concerns.
- manage payments and administration.
- meet professional, legal and regulatory obligations.
- investigate and respond to complaints.
- maintain the security of our systems and records; and
- protect patients and others where this is necessary for safeguarding or safety.
We only collect information that is relevant and necessary for these purposes.
4. Health information
Health information is special-category personal data under UK data-protection law and requires additional protection.
We process health information because it is necessary for the provision and management of healthcare and treatment and for the purposes permitted under applicable data-protection law.
Your information will be handled confidentially and only accessed by people who need it for legitimate clinical, administrative, legal or regulatory purposes.
HCPC standards require physiotherapists to maintain confidentiality and take reasonable steps to keep service-user information secure.
5. How we store your information
Your clinical documents and records are stored securely using Proton Drive.
Proton Drive uses end-to-end encryption for files stored within the service. Proton states that encrypted file contents cannot be decrypted by Proton itself and that access can be controlled through permissions.
Access to patient information is restricted to authorised individuals who require access for the provision or administration of your care.
We take reasonable technical and organisational measures to protect your information against:
- unauthorised access.
- accidental loss.
- destruction.
- alteration.
- inappropriate disclosure; and
- other unauthorised processing.
However, no electronic system can be guaranteed to be completely risk-free.
6. Email and electronic communication
We may use email to communicate with you about your appointment and care.
Where clinical information or documents are sent electronically, we will take appropriate security measures.
If you use a standard email provider, such as Gmail, Outlook or another provider, the security of the email after it leaves our systems may depend on the recipient’s email provider.
Where appropriate, we may use secure or password-protected methods to send sensitive clinical documents.
7. Who may receive your information?
We do not sell your personal or health information.
We may share relevant information where necessary with:
- Claire Robertson and authorised members of the team.
- healthcare professionals involved in your care.
- your GP or other healthcare professionals where appropriate and where lawful.
- hospitals, clinics or other healthcare providers involved in your care.
- organisations providing services necessary to operate the practice, such as IT, booking or payment providers.
- professional, regulatory or legal bodies where required.
- insurers or legal advisers where necessary and lawful.
- law enforcement or public authorities where legally required; and
- safeguarding organisations where necessary to protect a patient or another person.
We only share information that is necessary and relevant for the particular purpose.
Where information is being shared for purposes outside your care or where consent is required, we will seek your appropriate consent.
8. Sharing information with your GP or another healthcare professional
Where sharing information with another healthcare professional is necessary for your care, we will normally seek your agreement where required and share only relevant information.
If you ask us to send your clinical letter or report to another healthcare professional, we may ask you to confirm:
- who the information should be sent to.
- their organisation.
- their contact details; and
- what information you authorise us to share.
If you do not want us to share information with a particular third party, please tell us.
There are circumstances where information may need to be disclosed without your consent, including where disclosure is required by law or is necessary to protect you or another person from serious harm.
HCPC guidance states that confidential information should generally only be disclosed with permission, unless the law permits/requires disclosure or there are appropriate public-interest or best-interest grounds.
9. Your privacy rights
Depending on the circumstances and applicable legal requirements, you have rights concerning your personal information, including:
- the right to be informed about how your information is used.
- the right to request access to your personal information.
- the right to request correction of inaccurate or incomplete information.
- the right to request restriction of processing in certain circumstances.
- the right to request deletion of information in certain circumstances.
- the right to object to certain processing.
- the right to data portability in circumstances where this applies; and
- the right to withdraw consent where processing is based on consent.
These rights are not absolute and may be subject to legal exemptions, particularly where information forms part of a clinical record that we are required to retain.
The ICO confirms that individuals have rights including access, rectification, erasure, restriction and objection, subject to the circumstances and applicable exemptions.
10. Requesting access to your records
You can request a copy of the personal information we hold about you.
This is commonly known as a Subject Access Request (SAR).
Please contact us at:
Email: info@clairepatella.com
We may need to verify your identity before providing information.
We will deal with your request in accordance with applicable data-protection law.
11. Correcting your information
If you believe information we hold about you is inaccurate or incomplete, please contact us.
You can ask us to correct or complete the information.
The ICO confirms that individuals have a right to request rectification of inaccurate personal information.
12. Requesting deletion
You may ask us to delete personal information in circumstances where the law gives you a right to erasure.
However, the right to deletion is not absolute.
We may need to retain clinical information because we have a legal, professional or legitimate reason to do so, including maintaining an appropriate clinical record.
If we are required to retain information, we will explain this where appropriate.
13. How long we keep your information
Clinical records are retained in accordance with our Retention Policy and applicable professional and legal requirements.
Our current retention periods are:
Adult clinical records:
8 years from the date of your last treatment.
Children and young people:
8 years after their 18th birthday, or until they reach 25 years of age, where this is the applicable period.
Other administrative information may be retained for different periods depending on its purpose and applicable legal requirements.
When information is no longer required, it will be securely deleted or otherwise securely disposed of.
14. Children and young people
We take additional care when processing information relating to children and young people.
A child under 16 may be able to consent to physiotherapy and the processing of their health information if they have sufficient understanding and capacity to make the decision (known as Gillick competence).
Where a child is not able to provide valid consent, consent may need to be obtained from a person with parental responsibility or another person authorised to make the decision.
Young people aged 16 and 17 are generally treated as having capacity to make their own decisions unless there is evidence otherwise.
We will consider the child’s or young person’s wishes, capacity, privacy and best interests when deciding how information should be communicated.
HCPC and CSP guidance recognise the importance of capacity and the ability of a Gillick-competent child under 16 to consent to treatment.
15. Safeguarding
Confidentiality is important, but it is not absolute.
If we have a serious concern about the safety or wellbeing of a child, vulnerable person or another individual, information may need to be shared with an appropriate professional or authority.
Where possible and appropriate, we will explain this to you.
16. Complaints about your personal information
If you are concerned about how we have handled your personal information, please contact us first:
Email: info@clairepatella.com
We will investigate your concern and respond appropriately.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe that your personal information has been handled unlawfully.
ICO website: https://ico.org.uk/
The ICO is the UK’s independent supervisory authority for data-protection matters.
17. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, legal requirements, technology or data-processing arrangements.
The current version will be made available on our website.
18. Contact us
If you have any questions about this Privacy Notice or how your information is handled:
Claire Patella
Data Protection Contact: Claire Robertson
Email: info@clairepatella.com
Privacy Notice last updated: 10.09.26